Executive brief
Happyforms, a popular WordPress plugin used for creating contact forms and surveys, contains a security flaw that could allow an administrator to execute malicious code on the website's server. By exploiting this vulnerability, an attacker with high-level access could potentially take full control of the site, access sensitive data, or disrupt operations. This issue is particularly dangerous if the attacker is also able to upload files to the server.
Technical details
The Happyforms plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 1.26.12. The vulnerability exists within the `happyforms_get_form_partial()` function, which fails to properly validate file paths before inclusion. An authenticated attacker with Administrator-level privileges can exploit this to include and execute arbitrary .php files already present on the server. If combined with a file upload vulnerability or a method to place malicious PHP files on the file system, this can lead to remote code execution (RCE). The attack requires network access and high privileges, and is mitigated by the complexity of needing a target file to include.
Affected products
- happyforms Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms <= 1.26.12
Timeline
- 2026-07-10: advisory: Advisory published by Wordfence/NVD
References
- https://plugins.svn.wordpress.org/happyforms/trunk/core/classes/class-wp-customize-form-manager.php
- https://plugins.svn.wordpress.org/happyforms/trunk/core/helpers/helper-form-templates.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3494912%40happyforms&new=3494912%40happyforms
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e31119ab-963d-48a4-9948-0a0dce761918?source=cve